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Claims 

What is claimed is: 



11. A method for protecting a computer in an opened share mode, comprising: 

2 (a) running a computer on a network in an opened share mode; 

3 (b) monitoring attempts to access the computer by applications utilizing the 

4 network; 

5 (c) determining whether the applications attempt to modify the computer; and 

6 (d) executing a security event in response to any attempt to modify the computer. 

12. The method as recited in claim 1 , wherein the opened share mode allows 
2 other computers on the network to access data stored on the computer. 

13. The method as recited in claim 1 , wherein the opened share mode includes a 
2 virtual opened share mode. 

1 4. The method as recited in claim 3, wherein the virtual opened share mode 

2 indicates to other computers of an ability to write to the computer. 

1 5 . The method as recited in claim 4, wherein the computer operates in the 

2 virtual opened share mode by modifying an application program interface. 

1 6. The method as recited in claim 5, wherein the application program interface 

2 includes an operating system application program interface. 

17. The method as recited in claim 5, wherein the application program interface 
2 includes a network application program interface. 
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The method as recited in claim 1, wherein the opened share mode indicates a 



rii 



2 file structure parameter and a name parameter. 

19. The method as recited in claim 1 , wherein the opened share mode indicates a 
2 plurality of parameters that are randomly selected to prevent detection. 

1 10. The method as recited in claim 1 , wherein the opened share mode applies to 

2 each of a plurality of networks of which the computer is a member. 

1 11. The method as recited in claim 1 , wherein the opened share mode applies 

2 only to a predetermined list of application programs executable on the 

3 computer. 

1 12. The method as recited in claim 1 1 , wherein the predetermined list is created 

2 manually. 

1 13. The method as recited in claim 1 1 , wherein the predetermined list is created 

2 automatically. 

1 14. The method as recited in claim 1 , wherein the computer is run on the 

2 network in a plurality of opened share modes. 

1 15. The method as recited in claim 1 , wherein any attempt to modify the 

2 computer is utilized in a heuristic analysis for identifying a coordinated 

3 attack on multiple computers. 

1 16. The method as recited in claim 1 , wherein attempts to modify the computer 

2 are tracked. 

1 17. The method as recited in claim 1 , wherein it is determined whether the 

2 applications attempt to write to memory in the computer, and the security 
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event is executed in response to any attempt to write to memory in the 
computer. 

18. The method as recited in claim 1 , wherein it is determined whether the 
applications attempt to copy a virus to memory in the computer, and the 
security event is executed in response to any attempt to copy the virus to 
memory in the computer. 

19. The method as recited in claim 1 } wherein the security event includes logging 
the computer off the network in response to any attempt to modify the 
computer. 

20. The method as recited in claim 1 , wherein the security event includes 
terminating the application attempting to modify the computer. 

2 1 . The method as recited in claim 1 , wherein the security event includes 
deleting the application attempting to modify the computer. 

22. The method as recited in claim 1 , wherein the security event includes an alert 
transmitted via the network. 

23 . The method as recited in claim 22, wherein the alert includes information 
associated with the application attempting to modify the computer. 

24. A computer program product for protecting a computer in an opened share 
mode, comprising: 

(a) computer code for running a computer on a network in an opened share 
mode; 

(b) computer code for monitoring attempts to access the computer by 
applications utilizing the network; 
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7 (c) computer code for determining whether the applications attempt to modify 

8 the computer; and 

9 (d) computer code for executing a security event in response to any attempt to 
1 0 modify the computer. 

1 25. The computer program product as recited in claim 24, wherein the network 

2 includes the Internet. 

1 26. The computer program product as recited in claim 24, wherein the opened 

2 share mode allows other computers on the network to access data stored on 

3 the computer. 

1 27, The computer program product as recited in claim 24, wherein the opened 

2 share mode includes a virtual opened share mode. 



1 28. The computer program product as recited in claim 27, wherein the virtual 
s 2 opened share mode indicates to other computers of an ability to write to the 

3 computer. 



!^ 1 29. The computer program product as recited in claim 28, wherein the computer 

\& 2 operates in the virtual opened share mode by modifying an application 

3 program interface. 

1 30. The computer program product as recited in claim 29, wherein the 

2 application program interface includes an operating system application 

3 program interface. 

1 31. The computer program product as recited in claim 30, wherein the 

2 application program interface includes a network application program 

3 interface. 
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1 32. The computer program product as recited in claim 24, wherein the opened 

2 share mode indicates a file structure parameter and a name parameter. 

1 33. The computer program product as recited in claim 24, wherein the opened 

2 share mode indicates a plurality of parameters that are randomly selected to 

3 prevent detection. 

1 34. The computer program product as recited in claim 24, wherein the opened 

2 share mode applies to each of a plurality of networks of which the computer 

3 is a member. 

1 35. The computer program product as recited in claim 24, wherein the opened 

2 share mode applies only to a predetermined list of application programs 

3 executable on the computer. 

1 36. The computer program product as recited in claim 35, wherein the 

2 predetermined list is created manually. 

1 37. The computer program product as recited in claim 3 5, wherein the 

2 predetermined list is created automatically. 

1 38. The computer program product as recited in claim 24, wherein the computer 

2 is run on the network in a plurality of opened share modes. 

1 39. The computer program product as recited in claim 24, wherein any attempt to 

2 modify the computer is utilized in a heuristic analysis for identifying a 

3 coordinated attack on multiple computers. 

1 40. The computer program product as recited in claim 24, wherein attempts to 

2 modify the computer are tracked. 
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1 41 . The computer program product as recited in claim 24, wherein it is 

2 determined whether the applications attempt to write to memory in the 

3 computer, and the security event is executed in response to any attempt to 

4 write to memory in the computer. 

1 42. The computer program product as recited in claim 24, wherein it is 

2 determined whether the applications attempt to copy a virus to memory in the 

3 computer, and the security event is executed in response to any attempt to 

4 copy the virus to memory in the computer. 

1 43. The computer program product as recited in claim 24, wherein the security 

2 event includes logging the computer off the network in response to any 

3 attempt to modify the computer. 



^ ' 1 44. The computer program product as recited in claim 24, wherein the security 

C3 

in 2 event includes terminating the application attempting to modify the 

s _ 3 computer. 



1 45 . The computer program product as recited in claim 24, wherein the security 

2 event includes deleting the application attempting to modify the computer. 

1 46. The computer program product as recited in claim 24, wherein the security 

2 event includes an alert transmitted via the network. 

1 47. The computer program product as recited in claim 46, wherein the alert 

2 includes information associated with the application attempting to modify the 

3 computer. 

1 48. The computer program product as recited in claim 24, wherein at least a 

2 portion of the computer code resides on a gateway. 
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1 49. The computer program product as recited in claim 48, wherein the security 

2 event includes blocking access to the computer. 

1 50. A system for protecting a computer in an opened share mode, comprising: 

2 (a) logic for running a computer on a network in an opened share mode; 

3 (b) logic for monitoring attempts to access the computer by applications utilizing 

4 the network; 

5 (c) logic for determining whether the applications attempt to modify the 

6 computer; and 

7 (d) logic for executing a security event in response to any attempt to modify the 

8 computer. 

1 51. A method for protecting a computer in an opened share mode, comprising: 

2 (a) running a computer on a network in a virtual opened share mode, wherein the 

3 virtual opened share mode allows other computers on the network to access 

4 predetermined data and programs resident on the computer, and indicates to 

5 other computers of an ability to write to the computer; 

6 (b) monitoring attempts to access the computer by applications utilizing the 

7 network; 

8 (c) determining whether the applications attempt to modify the computer; 

9 (d) tracking the attempts of the applications to modify the computers; 

10 (e) transmitting an alert via the network in response to any attempt to modify the 

1 1 computer, wherein the alert includes information associated with the 

12 applications attempting to modify the computer; 

1 3 (f) logging the computer off the network in response to any attempt to modify 

14 the computer; and 

1 5 (g) deleting any application attempting to modify the computer; 

16 (h) wherein any attempt to modify the computer is utilized in a heuristic analysis 

17 for identifying a coordinated attack on multiple computers. 
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A computer program product for protecting a computer in an opened share 
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mode, comprising: 
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computer code for running a computer on a network in a virtual opened share 
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mode, wherein the virtual opened share mode allows other computers on the 




5 




network to access predetermined data and programs resident on the 




6 




computer, and indicates to other computers of an ability to write to the 
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associated with the applications attempting to modify the computer; 
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(f) 


computer code for logging the computer off the network in response to any 
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attempt to modify the computer; and 
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(g) 


computer code for deleting any application attempting to modify the 
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computer; 
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wherein any attempt to modify the computer is utilized in a heuristic analysis 
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for identifying a coordinated attack on multiple computers. 
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